Microsoft Sentinel Threat Hunting.
/lookup-sentinel
cti-skills is an open-source, MIT-licensed pack of 75 cyber threat intelligence skills for Claude Code and other AI coding assistants, built by Liberty91. Every other integration in the pack asks the world about an indicator; the /lookup-sentinel skill searches your own logs. Connect your Microsoft Sentinel workspace, read-only, with four values from the Azure portal, and the same conversation that identifies a malicious IP finishes by checking whether it ever showed up in your environment.
What it does.
The /lookup-sentinel skill discovers which tables a Microsoft Sentinel workspace actually ingests, then generates KQL only for tables that exist in that environment. You can ask it to sweep your logs for suspicious IPs, domains, file hashes, URLs and accounts, and when the table it would normally search is missing, it falls back to alternatives that can usually answer the same question. It can also hunt for attacker behaviour described by MITRE ATT&CK techniques, using the pack's KQL-writing skill and a local copy of the ATT&CK dataset, and you can run your own KQL against live data, always limited to a set time window.
Why table-adaptive matters.
No two Sentinel environments contain the same data, because that depends on which connectors each organisation has set up. Defender for Endpoint brings the Device tables, the Entra ID connector brings sign-in logs, and the syslog and CEF connectors bring CommonSecurityLog. So the skill starts with discovery: which tables your workspace knows about, which are actively receiving data and at what volume, and a per-table check for ground truth. Only then does it write queries, which means no broken KQL against missing tables and no hunts that look successful while running against data you do not collect.
Misses are findings too.
When neither the preferred table nor its alternatives exist, the skill reports that as a result in its own right: this behaviour is not visible in the logs you currently collect, and here is the gap. And a clean sweep is always reported as not observed in collected telemetry over the window, never as not compromised, because your logs only cover what your connectors collect and only go back as far as your retention allows. A mapped gap tells you where to improve your logging; a query that runs on nothing tells you nothing.
What access it needs.
Four values from the Azure portal: the tenant ID, an app registration's client ID and client secret, and the Log Analytics workspace ID, with the app granted a read-only Log Analytics Reader role on the workspace. The tool is read-only by design: it can run queries and list what data you have, and nothing else, so one Reader role is all it ever needs. The documented API limit of 200 requests per 30 seconds sits comfortably above anything the pack does.
How it fits your workflow.
The pack uses it automatically. When an investigation concludes that an indicator is malicious or suspicious, the skill checks your logs for that indicator straight away, and when you process a whole list of indicators at once, the confirmed-malicious ones are swept in one batch. If you already have the pack installed, update to v1.14.0 to get the skill: run /plugin update cti-skills in Claude Code and restart, or npx github:Liberty91LTD/cti-skills update for an npx install.
Frequently Asked Questions.
Want to see this on your own organisation?
Request a demo or start your free trial today, and get straight to AI-powered threat intelligence built around your organisation.